Phew! It has been a heck of a few weeks! Snow nearly halted half of the country. That was probably a bit hyperbolic, but I was on social media, and I saw shelves bare from the apocalypse-thinking of the masses. I started thinking about this a bit more. “What are some reasons people over-respond to emergencies, incidents, and other high-stress events?” Well, you know I will put this into the cybersecurity industry. After all, I own a cybersecurity business, and my CEO told me to write more. So, here we go.

Over-response through being under-informed

Let’s start here. This may make me sound like a broken record, but understanding our digital environments is a primary start to doing anything. It’s not just about creating a comprehensive incident response plan or a risk management plan. It’s about empowering yourself with the knowledge of your most valued assets, the interdependencies of your revenue streams, and who can help when things break. This understanding is the key to effective cybersecurity preparedness.

Many incidents are prolonged at the stage of identifying what is actually compromised and where that compromised system has inroads to other systems within the environment. This is also an issue when setting the priority or severity of the incident. It often seems like a guessing game – mainly due to the lack of understanding of what systems really make a difference to business operations and revenue. RECOMMENDATION: Know your environment. Track your systems, data, and users. Maintain a [near] absolute truth to your environment, risk, and business operations.

Over-response through being under-prepared

Preparation takes time, money, and resources—which seem to be few and far between these days. I was working with an organization, and I recommended that they write playbooks to help standardize responses to specific events. They starkly said, “We’ve no time to write papers when we are doing work.” Let’s say I left it there. I would still like to argue (because I am writing this, and I can) that writing these playbooks, plans, and policies is real work, and they lay the groundwork for operationalizing responses more consistently. We must build our responses off a foundational anchor. Policies establish standardized strategic methodology (because of risks, regulations, etc.). Plans establish standardized operations. Playbooks establish standardized tactical responses. May I say these standards also help you understand where your organization may need more time, money, or resources? RECOMMENDATION: Write relevant policies, plans, and playbooks to help standardize how your organization responds when everyone’s proverbial hair is on fire.

“Writing these playbooks, plans, and policies is real work, and they lay the groundwork for operationalizing responses more consistently.”

Over-response through being under-trained

When you [comprehensively] understand your environment and build policies, plans, and playbooks around that knowledge, you now need to practice and rehearse the worst-case scenarios. Rehearsing these scenarios is not just a formality. It’s a way to build confidence and resilience in you and your organization. If the policies, plans, and playbooks help you prepare, rehearsing helps you and your organization become resilient.

These can be rehearsed at the technical level (playbooks), the operations level (plans), and the executive level (policies). These rehearsals are called tabletop exercises. Now, they can come in all different sizes, but we won’t get into them here. These exercises can really get everyone involved and help them understand what is actually needed in response. From the actual incident to recovery, these exercises can be played out at any point within the crisis. That is what I love about these things! They are so versatile. RECOMMENDATION: Rehearse your most feared incidents and emergencies. Get everyone involved. And heck… call us if you need help… with anything!

So, when you meet with an Armageddon-like crisis, if you apply these three sections, you might respond just the right way. After all, you don’t need all of that toilet paper anyway.